Intrusion detection of one section only of a multimode fiber uses a light signal launched into the fiber at a location spaced from the source through a single mode fiber to establish a narrow spectral width, under-filled non-uniform mode field power distribution in the fiber. A small portion of the higher order signal modes at the a second location also spaced from the destination is sampled by a tap coupler and monitored for transient changes in the mode field power distribution which are characteristic of intrusion to activate an alarm. The active signal of a multimode optical fiber is monitored for both signal degradation and transient power disturbance patterns that could indicate fiber damage or physical intrusion. A translator can be provided in an existing optical fiber system in which the data signals are translated in wavelength and/or launch conditions to optimize the monitoring signals in an otherwise non-optimized system.